modiloader | e80421e725e99a4b97fc2a5492f1e0eaa87777a14a7aa11c202b1613c151331c

General

Target

85b780f08b016dd454c2a0f4bf2c91eb_JaffaCakes118
Size

653KB
Sample

241102-qxhsyavnhz
MD5

85b780f08b016dd454c2a0f4bf2c91eb
SHA1

0393172b0a8332f81e7f5bb61921855b80524814
SHA256

e80421e725e99a4b97fc2a5492f1e0eaa87777a14a7aa11c202b1613c151331c
SHA512

dd5504472fa52946cdb545a7a331ff032b30b19422e38dba91808767b8e2501337bc250cf22c49e3fc1046e1252129962f600ca84e12f09886ffc4479f2d9b82
SSDEEP

12288:tE0NR1s/Z5jrzIezVVRmy9S60TDJ0tIl6UTcmKGJ+1lqteLRXbRww786a:tE5/ZNrzXBVAy9S6Bt06UAmBQqt0Rbl

Score

10^/10

Malware Config

Targets

- Target
  
  85b780f08b016dd454c2a0f4bf2c91eb_JaffaCakes118
- Size
  
  653KB
- MD5
  
  85b780f08b016dd454c2a0f4bf2c91eb
- SHA1
  
  0393172b0a8332f81e7f5bb61921855b80524814
- SHA256
  
  e80421e725e99a4b97fc2a5492f1e0eaa87777a14a7aa11c202b1613c151331c
- SHA512
  
  dd5504472fa52946cdb545a7a331ff032b30b19422e38dba91808767b8e2501337bc250cf22c49e3fc1046e1252129962f600ca84e12f09886ffc4479f2d9b82
- SSDEEP
  
  12288:tE0NR1s/Z5jrzIezVVRmy9S60TDJ0tIl6UTcmKGJ+1lqteLRXbRww786a:tE5/ZNrzXBVAy9S6Bt06UAmBQqt0Rbl
Score

10^/10

modiloader discovery trojan
- ModiLoader, DBatLoader
  ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
  trojan modiloader
- Modiloader family
  modiloader
- ModiLoader Second Stage
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

ModiLoader, DBatLoader

Modiloader family

ModiLoader Second Stage

Deletes itself

Executes dropped EXE

Loads dropped DLL

Drops file in System32 directory

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2